{"id":"CVE-2026-114697","kind":"vulnerability","aliases":["CVE-2026-114697"],"related":[],"title":"QA Analytics heatmap plugin: stored XSS through unsanitized input","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1.","summary":"QA Analytics (qa-heatmap-analytics) <= 5.3.0.1 has unauthenticated stored XSS. WPSec names the 'event_ary' parameter as the stored input. Fixed in 5.3.0.2.","severity":"high","cvss":7.1,"epss":0.00251,"exploited":false,"exploited_at":null,"products":[{"name":"qa-heatmap-analytics","fixed":["5.3.0.2"],"affected":"<= 5.3.0.1","ecosystem":"wordpress"}],"ecosystems":["wordpress"],"tags":["other","qa-heatmap-analytics","unauthenticated","wordpress","wordpress-plugin","xss"],"not_affected_if":["plugin-not-installed","version-5.3.0.2-or-later"],"how_to_check":"WordPress admin > Plugins: QA Analytics version <= 5.3.0.1 is affected. Or run: wp plugin get qa-heatmap-analytics --field=version","fix":"Update QA Analytics (qa-heatmap-analytics) to 5.3.0.2 or later; deactivate the plugin if you cannot update.","status":"open","published_at":"2026-10-24T08:16:52+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","triaged_at":"2026-10-25T03:31:05+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-10-25T03:31:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"QA Analytics heatmap plugin: stored XSS through unsanitized input","impact":"medium","summary":"QA Analytics (qa-heatmap-analytics) by QuarkA fails to neutralize input before rendering it in web pages, so the stored input runs as script. An attacker who can store content in the plugin can run JavaScript in the browser of users who view it.","category":"other","nicknames":[],"who_cares":["wordpress","qa-heatmap-analytics"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker script runs in victims' browsers, stealing sessions or data.","analyst_note":"Confirm the affected product platform, the fixed version after 5.3.0.1, and which input is stored, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114697.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the QA Analytics qa-heatmap-analytics plugin at version 5.3.0.1 or earlier, per the NVD description. Sites without this plugin are not affected. Whether a non-admin role can store input the plugin renders is not stated in the sources.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000574,"input_tokens":3318,"output_tokens":484,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected product platform, the fixed version after 5.3.0.1, and which input is stored, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114697.","search":"'-114697':12A,15A '-2026':11A,14A '5.3.0.1':37B,86C '5.3.0.2':54B 'affect':80C 'allow':76C 'analyt':2A,24B,32B,36B,71C,75C,82C 'analytics':19A 'ari':46B 'cross':64C 'cross-sit':63C 'cve':10A,13A 'event':45B 'fix':52B 'generat':62C 'heatmap':3A,18A,23B,35B,74C 'improp':55C 'input':9A,51B,58C 'issu':79C 'n/a':84C 'name':43B 'neutral':56C 'page':61C 'paramet':47B 'plugin':4A,29B 'qa':1A,17A,22B,31B,34B,70C,73C,81C 'qa-heatmap-analyt':21B,33B,72C 'qa-heatmap-analytics':16A 'quarka':69C 'script':66C 'site':65C 'store':5A,40B,50B,77C 'unauthent':25B,39B 'unsanit':8A 'vulner':67C 'web':60C 'wordpress':26B,28B 'wordpress-plugin':27B 'wpsec':42B 'xss':6A,30B,41B 'xss.this':78C","nicknames":[],"mitigations":[],"who_affected":"Sites running the QA Analytics qa-heatmap-analytics plugin at version 5.3.0.1 or earlier, per the NVD description. Sites without this plugin are not affected. Whether a non-admin role can store input the plugin renders is not stated in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T08:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114697","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114697","severity":null,"published_at":"2026-10-24T08:16:52+00:00","modified_at":"2026-10-24T08:16:52+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","fetched_at":"2026-10-24T08:47:15+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114697:805","url":null,"severity":null,"published_at":"2026-10-25T04:02:42+00:00","modified_at":"2026-10-25T04:02:42+00:00","first_seen_at":"2026-10-25T04:02:42+00:00","fetched_at":"2026-10-25T04:02:42+00:00","note":"Fixed in 5.3.0.2 per CVE record (Patchstack CNA); stored input is the 'event_ary' parameter, unauthenticated, per WPSec WPSEC-2026-1479 (third party, not vendor; not verified). No vendor advisory found, no exploitation (CISA SSVC: none), no PoC seen. Nothing marked verified."},{"source":"epss","external_id":"CVE-2026-114697","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114697","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":3370,"url":"https://www.cve.org/CVERecord?id=CVE-2026-114697","title":"CVE Record CVE-2026-114697 (Patchstack CNA)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3371,"url":"https://wpsec.com/vuln/plugin/qa-heatmap-analytics/","title":"WPSec: qa-heatmap-analytics advisories (WPSEC-2026-1479)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}